ArtyfileARTYFILE
EN/DE

Privacy Policy

Last updated: 2 September 2026

This policy explains what personal data Artyfile processes when you use artyfile.com and its sister services (stream.artyfile.com, artists.artyfile.com, the Artyfile Stream apps), why we process it, and which rights you have. We keep it short and specific; where we name a service provider, we name the real one.

1. Who is responsible

Artyfile LTD, 120 Pall Mall, 3rd Floor, London SW1Y 5EA, United Kingdom (Company No. 16293441). Contact for all privacy matters: [email protected].

2. Hosting, security and server logs

The website runs on servers of Mittwald CM Service GmbH & Co. KG in Germany. Requests pass through the Cloudflare content-delivery and security network (Cloudflare, Inc.), which processes your IP address and request metadata to deliver pages and to block abusive traffic. Server logs (IP address, time, requested URL, user agent, status) are kept for a short period for security and troubleshooting and then deleted. Legal basis: our legitimate interest in operating a secure, available service (Art. 6(1)(f) GDPR / UK GDPR).

3. Cookies

We set only strictly necessary first-party cookies and no advertising cookies:

  • af_acct — keeps you signed in to your Artyfile account across *.artyfile.com (signed session token; deleted when you sign out or after expiry).
  • af_attr — remembers, for up to 90 days, how you first arrived on the site (for example a search engine or an AI assistant) so we can understand which channels lead to purchases. It contains no name, e-mail or identifier of you as a person.
  • af_admin — staff sign-in only.

Because no consent-requiring cookies are used, there is no cookie banner.

4. Web analytics (Matomo, cookie-free)

We measure page views, referrers, device type and interactions such as preview plays with a self-hosted Matomo instance operated by us. Matomo runs without cookies, and the data stays on our own infrastructure — it is not shared with third parties or combined with advertising networks. Legal basis: legitimate interest in understanding and improving the service (Art. 6(1)(f)).

5. Account

When you create an account we store your e-mail address, an optional name, a securely hashed password (never the password itself) and sign-in events. Sign-in links sent by e-mail (“magic links”) are single-use and expire. One account works across the Artyfile web properties and apps; the account service and the streaming service exchange only what is needed to keep your account consistent (e-mail, name, subscription state). Legal basis: performance of the contract with you (Art. 6(1)(b)).

6. Purchases, invoices and downloads

Payments are processed by Stripe, Inc. on Stripe-hosted checkout pages. Stripe collects your e-mail address, billing name and address and your payment details; Artyfile never receives your card number. We receive the order confirmation, e-mail address and billing address to issue your licence, invoice and certificate. Order and invoice records are retained as long as tax and commercial law require (typically ten years). Download links are protected by signed tokens tied to your order. Legal basis: contract performance (Art. 6(1)(b)) and legal obligations (Art. 6(1)(c)).

7. Limited Edition ownership register

If you acquire a Limited Edition share, your order is entered in the Artyfile ownership register. Publicly, a share is shown as “Collector #N” unless you actively choose to display a name in your account. Quarterly statements are shown in your account only.

8. E-mail

Transactional e-mails (order confirmations, invoices, sign-in links, account notices) are sent through a mail relay operated for us in Germany. Our newsletter is sent only to addresses that have opted in; every issue contains an unsubscribe link and unsubscribed addresses are kept on a suppression list so they are not contacted again. Legal basis: contract performance for transactional mail, consent for the newsletter (Art. 6(1)(a)), revocable at any time.

9. AI chat assistant

The chat assistant on this site is powered by a language model from Anthropic, PBC. The messages you type, together with the conversation context, are sent to Anthropic to generate a reply, and the conversation is stored by us for a limited time to keep the dialogue coherent and to improve answer quality. Please do not enter sensitive personal data in the chat. Legal basis: legitimate interest in offering assisted search and support (Art. 6(1)(f)).

10. Catalog search

To rank search results, the text of your search query (not your account data) may be sent to OpenAI, L.L.C. to compute a semantic representation. Search queries are also logged in anonymised form to understand which music people look for.

11. AI agents and machine access

Artyfile offers a public, read-only catalog interface for AI assistants and agents (including an MCP server and an OpenAPI description). These interfaces expose catalog data only. Any purchase initiated through an agent is still completed by you on a Stripe checkout page, under sections 6 and 3 of this policy. If you reach us from an AI assistant such as ChatGPT, the referring service is recorded as your arrival channel (see the af_attr cookie).

12. Service providers and international transfers

We use the following processors: Mittwald (hosting, Germany), Cloudflare (network security and delivery, EU/US), Stripe (payments, EU/US), Anthropic (chat assistant, US), OpenAI (search ranking, US), a German e-mail relay provider, and Google (Search Console, YouTube and analytics APIs for aggregated, non-personal reporting). Where data leaves the UK or EU, transfers rely on adequacy decisions, the EU–US Data Privacy Framework where the provider is certified, or standard contractual clauses.

13. Retention

We keep personal data only as long as needed for the purpose it was collected for: account data until you delete your account; order and invoice data for statutory retention periods; attribution data up to 90 days; server logs for a short security window; chat conversations for a limited period after the conversation ends.

14. Your rights

You have the right to access the personal data we hold about you, to have it corrected or erased, to restrict or object to processing, to receive it in a portable format, and to withdraw any consent you have given. Write to [email protected]. You may also lodge a complaint with the UK Information Commissioner’s Office or the supervisory authority of your EU member state.

15. Children

Our services are directed at businesses and adult creators. We do not knowingly collect data from children under 16.

16. Changes

We update this policy when our services change. The date at the top shows the current version.